Cracking

When working as a forensic examiner, it is not uncommon to encounter encrypted files, entire partitionsPartition, or even devices. When that is the case, the encrypted data must be decrypted in order for the forensic expert to be able to examine it. The intent of this chapter is to provide the reader with a practical overview of the steps commonly involved in the process of crackingCracking encrypted data. While know-how and experience may be the most important skills in successful crackingCracking, everyone needs a good tool for assistance. As such, this chapter also presents and discusses the open-sourceOpen-source tool HashcatHashcat that can be used for the purpose of passwordPassword crackingCracking. The chapter will also present tools for creating custom wordlistsWordlists which can be utilized by HashcatHashcat. Thus, this chapter provides the reader with a practical implementation of the theoretical knowledge that was previously introduced.